Mozilla Firefox 158.0.1 is rolling out with some important security fixes.
Now, I don’t tend to cover Firefox point releases as mainly ship minor fixes for things the majority of users won’t have noticed were wrong in the first place. The Firefox 158.0.1 update is more ‘meaty’ than usual fare.
Among the security advisories this update covers are eight intermediate certificates belonging to the eMudhra certificate authority, whose private keys were compromised.
Anyone holding those keys could issue certificates that browsers accept as genuine for any website. If they can also intercept a user’s connection, they could impersonate the site and read or alter the traffic.
Most Firefox users were already protected as Mozilla revoked the certificates on 17 October (within hours of being notified) using OneCRL, which works in the background.
Even so, Firefox 158.0.1 bundles the revocation into this update. Users whose network policies or other settings disable OneCRL updates get covered when upgrading to this release.
Bug fixes in this build resolve the usual grab-bag of issues, including:
- Websites jumping to the top of the page during text selection
- Built-in VPN unable to activate for some users
- Firefox windows on the wrong monitor on Linux multi-monitor setups
- Some JPEG XL format showing semi-transparent areas too dark
The update is already live. If you use Firefox on Windows or macOS, or run the Linux binary builds, you’ll get the update in-app next time you run it. If Firefox is installed from a repo or alternative store, you’ll need to install it manually.
Ubuntu users running the Firefox Snap will receive this update automatically in the background, and it will apply on the next app restart.
(via soeren-hentzschel.at)